CVE Vulnerability Catalog

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public.

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite process memory growth and denial of service.

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive publish-access configuration and metadata.

SiYuan is affected by an information disclosure vulnerability in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents (including private or unpublished ones) modified in the same cross-document transaction, disclosing internal identifiers and cross-document relationships. Document body contents are not directly exposed.

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal configuration by knowing the hidden notebook identifier and file path.

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with </script>. Attackers can craft a malicious URL with an error parameter containing script breakout sequences to execute arbitrary JavaScript in the victim's browser context on the login page.

Menulux Portal by Menulux Software Inc. has a missing authorization vulnerability that allows accessing functionality not properly constrained by ACLs. This issue affects versions before 20260903211448.

Menulux Portal by Menulux Software Inc. has a stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 20260903211448.

A flaw was found in libsoup where sending an HTTP/2 request body from a non-pollable input stream can lead to buffering more data than the flow-control window allows. A malicious server can shrink SETTINGS_INITIAL_WINDOW_SIZE while the buffered read is in progress, causing the client to copy the full buffer into a smaller DATA callback without bounds check, potentially aborting the process or failing the HTTP/2 session.

The E-cab Taxi Booking Manager for WooCommerce plugin before version 2.0.5 does not validate client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.

JetPopup plugin by Crocoblock contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Affects versions through 2.0.20.2.

A CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on REST request detection, which can be influenced by request properties like the Accept header. An attacker can craft cross-origin requests that are treated as REST traffic, bypassing CSRF protection for session-authenticated requests. The fix restricts exemptions to requests carrying a MISP API key and adds support for X-CSRF-Token header.

DreamMaker by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript in a user's browser via a malicious website.

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature.

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check can be bypassed on 32-bit systems due to an integer overflow, allowing a crafted network packet to trigger out-of-bounds memory access and crash the Corosync daemon, resulting in denial of service for the affected cluster node. The overflow does not occur on 64-bit systems.

DOM-Based XSS vulnerability in the WoodMart theme by Xtemos. Improper neutralization of input during web page generation. Affects versions before 8.3.8.

Missing release of memory after effective lifetime in Softing smartLink allows resource leak exposure. Affects smartLink HW-PN versions from 1.04 before 1.10.